CVE-2026-34555: iccDEV: SBO in CIccTagFixedNum::GetValues()
Published Mar 31, 2026
·Updated
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to version 2.3.1.6, there is a stack-buffer-overflow (SBO) in CIccTagFixedNum<>::GetValues() and a related bug chain. The primary crash is an AddressSanitizer-reported WRITE of size 4 that overflows a 4-byte stack variable (rv) via the call chain CIccTagFixedNum::GetValues() -> CIccTagStruct::GetElemNumberValue(). This issue has been patched in version 2.3.1.6.
Affected Software
2 affected components
iccDEV iccDEV<2.3.1.6
Color iccDEV<2.3.1.6
Remediation
Event History
Mar 31, 2026
CVE Published
via MITRE·10:21 PM
Data Sourced
via MITRE·10:21 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
RemedyDescriptionSeverityWeaknessAffected Software